API security is the practice of protecting application programming interfaces from misuse. It controls who can call them, what data they can reach and how much they can request.
OAuth 2.0 is an authorisation framework that lets an application act on a user's behalf without their password. It issues limited, revocable tokens tied to specific scopes.
The OWASP Top 10 is an awareness document from the OWASP Foundation listing the most critical categories of web application security risk. It is revised periodically using community data.
Rate limiting is a technique that controls how many requests a client can make to a service within a set period of time. It protects systems from overload, abuse and runaway costs.
An API gateway is a service that sits in front of a set of APIs as a single entry point. It routes requests and handles shared concerns such as authentication, rate limiting, logging and transformation.
Dynamic application security testing (DAST) probes a running application from the outside with crafted requests. It watches how the application responds for signs of security weaknesses an attacker could use.
Role-based access control (RBAC) is an access model in which permissions attach to roles rather than people. Users and services get access by being assigned one or more roles.
A clear proven process, that delivers
You've seen our ideas - now go deeper.
Discover more insights, guides, and engineering practice.